AGENT INTEGRATIONS

YOUR AGENT.
ONE GOVERNED LAUNCH.

Misconfig does not proxy the model or ask for your cloud secrets. A local Go runtime starts the agent with temporary native configuration, evaluates signed policy, and sends redacted receipts to the control plane.

CODEXLIVE SLICE

Native hooks

Direct tool allow and deny are live-proven on the pinned release. Nested and broader subagent acceptance remains open.

CLAUDE CODEPREVIEW

Session settings

PreToolUse, PostToolUse, and PostToolUseFailure adapters are implemented. Authenticated live acceptance remains open.

MCPPLANNED

Tool discovery

MCP can expose governed infrastructure actions, but it is not the enforcement boundary by itself. The local runtime remains authoritative.

CI + AGENT PLUGINPLANNED

Workflow context

Skills and agent instructions will teach coding agents which infrastructure actions must pass through Misconfig.

THE LOCAL CONTRACT

Install once.
Choose the profile per session.

The runtime keeps its state under an explicit Misconfig home, discovers agent installations and provider names without uploading credentials, and previews managed changes before writing native hook configuration.

terminal

$ misconfig setup
device enrolled

$ misconfig profile list
production-read    codex    signed
alarm-change       claude   signed

$ misconfig run --profile alarm-change
session started · policy cached · receipts on

THREE SEPARATE BOUNDARIES

Transport, policy, and credentials are not the same thing.

TRANSPORT

How the agent calls a tool

Native hooks, MCP, shell, or a typed connector describe the action. Transport alone grants nothing.

POLICY

Whether this session may proceed

The local runtime evaluates the immutable signed release before the supported tool call.

CREDENTIAL

What the provider will accept

Attach mode uses local authority and is bypassable. Brokered short-lived authority is the stronger planned boundary.

DO NOT REPLACE THE AGENT'S SAFETY MODE

Misconfig adds company policy.
It does not silently select “Full Access.”

AGENT PERMISSION MODEWhat the process may attempt locally+MISCONFIG SESSION POLICYWhich infrastructure action the named session may complete+PROVIDER AUTHORITYWhat AWS, Kubernetes, or another provider will accept

FIRST SESSION

Connect a pinned agent release and govern one real workflow.

Open the console

YOUR AGENT.ONE GOVERNED LAUNCH.